GitLab
Connect GitLab to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect GitLab to collect version control evidence automatically.
Step-by-step guide: Connect GitLab.
| Category | Version Control |
| Connect with | API token |
| What a connection produces | Automated evidence collection |
Connect with an API token
-
In GitLab:
- In GitLab, select your avatar in the upper-right corner, then select Edit profile.
- In the left sidebar, select Access › Personal access tokens.
- From the Generate token dropdown list, select Legacy token.
- In Token name, enter a name (for example Safeguard); optionally fill Token description.
- In Expiration date, enter an expiry date (if left empty, it defaults to 365 days from today).
- Select the scopes read_api and read_repository (read-only).
- Select Generate token, then copy and save the token. After you leave or refresh the page, you cannot view it again.
Where to find the other values:
- Base URL (self-hosted): The address of your GitLab instance (for example https://gitlab.example.com). Leave empty for GitLab.com.
GitLab shows the secret only once, so copy it before you leave the page.
read_api grants read access to the API for the token's scope; read_repository grants pull access to private projects. Administrators can cap token lifetime, and instance or enterprise-group admins can disable personal access tokens entirely (the page then returns 404). The token sees only what the creating user can see.
Source: docs.gitlab.com, docs.gitlab.com, checked 2026-10-07.
-
On Compliance › Connectors, open GitLab, click Connect, choose API token and fill in:
Field What to enter Base URL (self-hosted) Optional. API token / PAT Required. Stored encrypted and never shown again. -
Click Connect with token.
Frameworks
Safeguard's automated tests read GitLab and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | C1.1, CC2.1, CC6.1, CC6.2, CC6.3, CC6.7, CC7.1, CC7.2, CC7.3, CC7.4, CC7.5, CC8.1 | 46 |
| ISO/IEC 27001 | Automated tests | A.5.3, A.5.9, A.5.14, A.5.15, A.5.16, A.5.17, A.5.18, A.5.25, A.5.26, A.5.27, A.6.5, A.8.2, A.8.4, A.8.5, A.8.8, A.8.12, A.8.15, A.8.24, A.8.25, A.8.28, A.8.29, A.8.32 | 46 |
| HIPAA Security Rule | Automated tests | 164.308(a)(1), 164.308(a)(3), 164.308(a)(4), 164.308(a)(5), 164.308(a)(6), 164.312(a)(1), 164.312(b), 164.312(c)(1), 164.312(d) | 37 |
| PCI DSS | Automated tests | 6.2.4, 6.3.1, 6.3.2, 6.3.3, 6.5.1, 7.2.1, 7.2.2, 7.2.4, 8.2.5, 8.4.2, 8.6.3, 10.5.1, 12.10.1, 12.10.6 | 38 |
| NIST CSF 2.0 | Automated tests | ID.AM-02, ID.IM-03, ID.RA-01, PR.AA-01, PR.AA-03, PR.AA-05, PR.DS-01, PR.PS-01, PR.PS-02, PR.PS-04, PR.PS-06, RS.MA-02, RS.MA-03, RS.MI-02 | 43 |
These tests are switched on per workspace by the Safeguard team.
GitLab Issues, GitLab Self-Managed connect to the same provider as GitLab, and these tests run for a connection made through any of them.
Related
- Version Control connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks